Splunk Search

Community Activity

How to add a new row to a lookup using a Splunk query? Is there a Splunk query to add a new row or a new column to a lookup table? I specifically ask for a query because I... by agentsofshield Path Finder in Splunk Search 03-12-2019 1 9	1	9
How to calculate and add missing field to source? source A : filename,title,version,type,date source B: filename,date I want to compute the title field for source b a... by user93 Communicator in Splunk Search 03-12-2019 0 4	0	4
DB connect Java sql SQL SYNTAXError Exception ORA-00933 command not properly ended I wan to count no of rows or columns injected in splunk from oracle database. Purpose of this is to compare data with... by rakesh44 Communicator in Splunk Search 03-12-2019 0 1	0	1
How to correlate events related to the same session from two indexes by time range Hi folks, I have 2 indexes containing information as below: index ABC _time sessionkey ... by ADRIANODL Explorer in Splunk Search 03-12-2019 0 1	0	1
Formatting Callout/Lookup Data to include non-exact matches. (Lookup/log/callout issue). Hi all, Apologies for the vague title, I have a lookup problem that I need help with, so any help is greatly appreci... by danfinan Explorer in Splunk Search 03-12-2019 0 0	0	0
I want to replace the time to a variable in the below query.Plz Help \| lookup error_rules_latest.csv EventType OUTPUT alert_type wait_time reoccurrence_window threshold_count reoccurrenc... by veerendra_modi Loves-to-Learn in Splunk Search 03-12-2019 0 5	0	5
Event log cannot be fully displayed in Field Extractor Hey fellow Splunker's. I'm trying to extract some fields from Windows event logs. When I search these logs the conten... by LuiesCui Communicator in Splunk Search 03-12-2019 0 4	0	4
How to extract filename from the path? Hi All I want to extract file name from the path Ex: ..../../default/folder/temp.txt output: Filename temp.txt by eduspk Explorer in Splunk Search 03-12-2019 0 2	0	2
Why is a lookup working on one search head and not another? How can I determine: 1) Why a Lookup is working on one search head but not on another? 2) How to get it to work on ... by DavisLee New Member in Splunk Search 03-12-2019 0 4	0	4
How to add a word after a count? Hello I use the search below and I would like to do 2 different things 1) How to do for adding a word after the stat... by jip31 Motivator in Splunk Search 03-12-2019 0 4	0	4
How to filter name by id which start with a specific number? Hi All Please help me with rex to filter name by id which start with "9" . Ex: Sample log ContactId:"12345,5678,9... by eduspk Explorer in Splunk Search 03-12-2019 0 2	0	2
How to search a lookup table or file by the column that has timestamp I'm trying to pull events from a lookup file that has in one column a timestamp. There will be instances where I'll ... by wtaylor149 Explorer in Splunk Search 03-12-2019 0 5	0	5
Need to search all request based on IP address I have these pattern in logs and I want to search burst of requests coming from one IP address For example: line: ... by varshna New Member in Splunk Search 03-11-2019 0 6	0	6
How to sort the column names alphabetically at the end of the search? This is my sample search: \| makeresults \| eval data = " 1-Sep 657 34 35; 2-Sep 434 34 35; " \|... by HattrickNZ Motivator in Splunk Search 03-11-2019 0 3	0	3
How do I add an extra row to calculate the average of the rows above? I have connected to my database using Splunk DBConnect and using a simple sql query I have managed to get some data f... by BobKimata Path Finder in Splunk Search 03-11-2019 1 3	1	3
How to find a log entry that doesn't have a match with another one? So, I get a bunch of log entries that look something like this (grossly simplified) example: host1 tag - foo host1 t... by mortya New Member in Splunk Search 03-11-2019 0 1	0	1
How to get the first and last number of consecutive integers by search? Hello Splunkers, Need your help on this. This is my query for testing: \| fields id \| sort id \| delta id AS delta... by Oracle Explorer in Splunk Search 03-11-2019 0 4	0	4
'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d" (earliest vs. earliest_time) Greetings, 'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d". Is this a known i... by coreybfoulds New Member in Splunk Search 03-11-2019 0 2	0	2
How to edit my search to compare a lookup table to an index? I have tried all of the examples but am still not getting accurate results. I have a lookup table with (1) column on... by tlmayes Contributor in Splunk Search 03-11-2019 0 6	0	6
Why is rename not working for Timechart Lists? Hello, I'm running into an issue trying to rename timechart lists. I'd like to give these a more friendly presentati... by jason16v Engager in Splunk Search 03-11-2019 0 2	0	2
How come our INPUTLOOKUP is returning no results? I'm trying to get this use case going from MS Windows AD Objects, but I can't get any results. index=wineventlog sou... by sbgoldberg13 Explorer in Splunk Search 03-11-2019 0 4	0	4
How do I perform a stats count(fieldname) without it deleting all other search results output? I do believe I'm missing something fundamental here.... So, the search: index=X returns many events where each even... by williamcharlton Path Finder in Splunk Search 03-11-2019 0 4	0	4
How to select yesterdays date from the following search? Hello, I know it is a simple question but I am somehow struggling with it. I have the following search: index=mlbso... by damucka Builder in Splunk Search 03-11-2019 0 1	0	1
Efficient and "correct" way to counting stats based on a sequence of events within a rolling timeframe Creating stats count based on a sequence of events within a timeframe. For example, count the unique sessions, withi... by mlorrette Path Finder in Splunk Search 03-11-2019 1 4	1	4
How to use of Group by on the Event Number column to get the latest result by EventTime? I have a table like below in Splunk I want to apply a group by on Event Number col and want to get the top(latest) ... by nilanjankc New Member in Splunk Search 03-11-2019 0 6	0	6